Sign-up

ID

VAR-202505-1895


CVE

CVE-2025-4859


TITLE

D-Link Systems, Inc.  of  DAP-2695  Cross-site scripting vulnerability in firmware

Trust: 0.8

sources: JVNDB: JVNDB-2025-005560

DESCRIPTION

A vulnerability was found in D-Link DAP-2695 120b36r137_ALL_en_20210528. It has been rated as problematic. This issue affects some unknown processing of the file /adv_macbypass.php of the component MAC Bypass Settings Page. The manipulation of the argument f_mac leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Other parameters might be affected as well. This vulnerability only affects products that are no longer supported by the maintainer. D-Link Systems, Inc. of DAP-2695 Firmware has a cross-site scripting vulnerability.Information may be obtained and information may be tampered with. D-Link DAP-2695 is a high-performance dual-band wireless access point from D-Link. D-Link DAP-2695 has a cross-site scripting vulnerability, which is caused by the lack of effective filtering and escaping of user-supplied data by the parameter f_mac in the file /adv_macbypass.php. No detailed vulnerability details are currently provided

Trust: 2.16

sources: NVD: CVE-2025-4859 // JVNDB: JVNDB-2025-005560 // CNVD: CNVD-2025-10946

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2025-10946

AFFECTED PRODUCTS

vendor:dlinkmodel:dap-2695scope:eqversion:1.20b36r137_all_en_202105286

Trust: 1.0

vendor:d linkmodel:dap-2695scope:eqversion:dap-2695 firmware 1.20b36r137 all en 202105286

Trust: 0.8

vendor:d linkmodel:dap-2695scope: - version: -

Trust: 0.8

vendor:d linkmodel:dap-2695scope:eqversion: -

Trust: 0.8

vendor:d linkmodel:dap-2695 120b36r137 all en 20210528scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2025-10946 // JVNDB: JVNDB-2025-005560 // NVD: CVE-2025-4859

CVSS

SEVERITY

CVSSV2

CVSSV3

cna@vuldb.com: CVE-2025-4859
value: MEDIUM

Trust: 1.0

nvd@nist.gov: CVE-2025-4859
value: MEDIUM

Trust: 1.0

OTHER: JVNDB-2025-005560
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2025-10946
value: LOW

Trust: 0.6

cna@vuldb.com: CVE-2025-4859
severity: LOW
baseScore: 3.3
vectorString: AV:N/AC:L/AU:M/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.4
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

OTHER: JVNDB-2025-005560
severity: LOW
baseScore: 3.3
vectorString: AV:N/AC:L/AU:M/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2025-10946
severity: LOW
baseScore: 3.3
vectorString: AV:N/AC:L/AU:M/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: MULTIPLE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 6.4
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

cna@vuldb.com: CVE-2025-4859
baseSeverity: LOW
baseScore: 2.4
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: UNCHANGED
confidentialityImpact: NONE
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 0.9
impactScore: 1.4
version: 3.1

Trust: 1.0

nvd@nist.gov: CVE-2025-4859
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 1.7
impactScore: 2.7
version: 3.1

Trust: 1.0

NVD: JVNDB-2025-005560
baseSeverity: MEDIUM
baseScore: 4.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: HIGH
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2025-10946 // JVNDB: JVNDB-2025-005560 // NVD: CVE-2025-4859 // NVD: CVE-2025-4859

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.0

problemtype:CWE-94

Trust: 1.0

problemtype:Cross-site scripting (CWE-79) [NVD evaluation ]

Trust: 0.8

problemtype: Cross-site scripting (CWE-79) [ others ]

Trust: 0.8

problemtype: Code injection (CWE-94) [ others ]

Trust: 0.8

sources: JVNDB: JVNDB-2025-005560 // NVD: CVE-2025-4859

EXTERNAL IDS

db:NVDid:CVE-2025-4859

Trust: 3.2

db:VULDBid:309401

Trust: 1.8

db:JVNDBid:JVNDB-2025-005560

Trust: 0.8

db:CNVDid:CNVD-2025-10946

Trust: 0.6

sources: CNVD: CNVD-2025-10946 // JVNDB: JVNDB-2025-005560 // NVD: CVE-2025-4859

REFERENCES

url:https://github.com/fizz-is-on-the-way/iot_vuls/tree/main/dap-2695/xss_mac_bypass

Trust: 2.4

url:https://vuldb.com/?id.309401

Trust: 1.8

url:https://vuldb.com/?submit.575101

Trust: 1.8

url:https://www.dlink.com/

Trust: 1.8

url:https://vuldb.com/?ctiid.309401

Trust: 1.0

url:https://nvd.nist.gov/vuln/detail/cve-2025-4859

Trust: 0.8

sources: CNVD: CNVD-2025-10946 // JVNDB: JVNDB-2025-005560 // NVD: CVE-2025-4859

SOURCES

db:CNVDid:CNVD-2025-10946
db:JVNDBid:JVNDB-2025-005560
db:NVDid:CVE-2025-4859

LAST UPDATE DATE

2025-05-30T23:16:44.999000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2025-10946date:2025-05-29T00:00:00
db:JVNDBid:JVNDB-2025-005560date:2025-05-23T01:38:00
db:NVDid:CVE-2025-4859date:2025-05-22T18:17:04.033

SOURCES RELEASE DATE

db:CNVDid:CNVD-2025-10946date:2025-05-29T00:00:00
db:JVNDBid:JVNDB-2025-005560date:2025-05-23T00:00:00
db:NVDid:CVE-2025-4859date:2025-05-18T05:15:16.977